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Topic: Steering Group update 


Issue: The minutes (inc draft minutes) for the following recent steering 
groups are presented for information: 

e Change Board - 20 November 

e Policy SG - 8 November 

e Operations SG - 10 November 


Peter Bloomfield 


The minutes will be published as an SLT paper. 
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Change Programme Board Minutes 


20 November 2017 


Members 
Paul Arnold 
Steve wood 


James Dipple-J ohnstone 


Jonathan Bamford 
Mike Collins 
Emma Deen 
Faye Spencer 
Rob Parker 
Andrew Laing 
Steve Eckersley 
Anulka Clarke 
Louise Byers 
Rachael Cragg 
Sarah Meyers 


Attendees 
Garreth Cameron 
Kirsty Keogh 


Secretariat 
Caroline Robinson 


Deputy Chief Executive Officer (Chair) 
Deputy Commissioner (Policy) 

Deputy Commissioner (Operations) 

Head of Parliament and Government Affairs 
Head of Organisational Development 

Head of Business Services & IT 

Head of Customer Contact 

Head of Corporate Communications 

Head of Data Protection Complaints and Reviews 
Head of Enforcement 

Head of Assurance 

Head of Risk & Governance 

Group Manager Change Programme 
Change Programme Manager 


Group Manager, Private Sector Engagement 
Group Manager, Media Relations 


Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Jo Pedder, Ken Macdonald and Adam 


Sowerbutts. 


2. Matters arising from the previous meeting 


Minutes 


The minutes from the previous meeting were agreed. 


Action Board 


The actions were updated and cleared where possible. 


3. Monthly Report Review 
Enabler Projects 
e Paul Arnold updated the group on the progress on GDPR 
Internal Compliance. 


e Louise Byers updated on the work being carried out looking at 
the ICO privacy notice. 


e Updates were given on the new funding regime following 
recent discussions with DCMS. 


Service Delivery Projects 
e Faye Spencer updated on the Personal Data Breach helpline. 


e Internal recruitment is underway for the Change Programme 
Team to replace team members who have moved on to other 
roles within the organisation. 


Policy & Engagement 
e Garreth Cameron confirmed that the development of the core 
GDPR training modules is progressing well. 


e The delivery of internal training was discussed. 
e Steve Wood updated on the outsourcing of guidance. 


e The proposal for setting up a separate project board for Policy 
was discussed. 


Action 
Rachael Cragg to identify the products already planned, such as 
Know Abouts, etc., that can be classed as key GDPR training. 


Action 
Rachael Cragg to set up a meeting to discuss inter-dependencies 
between Policy and Operations. 


4. Regulatory Action Plan 
Discussion 
The paper was discussed and James Dipple-Johnstone invited 
comments on it by Friday 1 December. 


5. Intelligence Decision Paper 
Discussion 
The paper was discussed. 


Decision 

It was agreed that this paper will be incorporated into the 
intelligence strategy paper being prepared by Adam Stevens. This 
paper to go to Policy Steering Group and then the Senior Leadership 


Team. 


6. Internal Compliance 


Discussion 
Paul Arnold updated on this item during the discussions on the 


Enabler Project report. 


7. Communications Grid 
Discussion 
There was no discussion on this item. 


8. RAIDLog 


Discussion 
e No new risks were identified 


e Therisk relating to the delay of the ICE 360 project was 
discussed. 


e Jonathan Bamford highlighted that the risk relating to 
relations with the Home Office has decreased. 


e The following risks were allocated owners: 
o ePrivacy : Jo Pedder 
o TPS Re-procurement : Steve Eckersley 
o PDARFs: James Dipple-Johnstone 


Actions 
Rachael Cragg to update the RAID log. 


9. Any Other Business 
Robert Parker confirmed that the Guide to GDPR will be launched on 


the website on 21 November. 
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Policy Steering Group minutes 


8 November 2017 


Members 

Steve Wood 
Emma Bate 
Jonathan Bamford 
Ken Macdonald 
Jo Pedder 
Heather Dove 
Robert Parker 
Adam Sowerbutts 


Anulka Clarke 
Peter Brown 
Rachael Cragg 


Attendees 
Carl Wiper 


Secretariat 
Caroline Robinson 


Deputy Commissioner (Policy) (Chair) 
General Legal Counsel 

Head of Parliament and Government Affairs 
Head of ICO Regions 

Head of Policy and Engagement 

Head of Finance 

Head of Corporate Communications 

Head of Freedom of Information Complaints and 
Appeals 

Head of Assurance 

Group Manager (Technology Policy) 

Group Manager Change Programme 


Group Manager 


Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Faye Spencer, Richard Marbrow and 


Jo Pedder. 


Steve Wood welcomed Carl Wiper to the meeting in place of Jo 


Pedder. 


2. Matters arising from the previous meeting 


Minutes 


The minutes of the previous meeting were agreed. 


Action Board 


The outstanding actions were updated and cleared where possible. 


Action 


Adam Stevens to recirculate the finalised priority case procedure. 


3. Risks Register 
Discussion 
The opportunity to shape the DP regime by influencing government 
and international opinion was discussed. 


It was asked whether recruitment risks should be more focused. 


Decision 
It was agreed that recruitment is on the risk register as an overall 
ICO risk and does not need to be more focused. 


Actions 
Emma Bate to review the opportunity on the risk register and add 
to the agenda for the first meeting of the EU Withdrawal Planning 
Group. 


4. Priority Case Tracker 
Discussion 
Steve Wood confirmed that priority cases are now being reviewed 
by the Senior Leadership Team on a monthly basis. 


Steve Wood updated the group on the decision at the recent Senior 
Leadership Team meeting regarding cases that have been removed 
or added to the tracker. 


The remaining live cases on the tracker were discussed and 
updated. 


Actions 

Caroline Robinson to ask Steve Eckersley to give an update on 
Operation Spruce to the Policy SG members before the next PSG 
meeting (7 December 2017) 


5. Review of Priority Policy Work streams 
Discussion 
Steve Wood reviewed the most important cases on the work stream 
tracker: - 
e Post-Brexit planning; a group has been reconvened and will 
be chaired by Emma Bate. 
e Extension of FOI outsourcing; work progressing well. 
e Charities; the follow up report to Parliament remains ongoing 
e Sandbox; Jonathan and Anulka will be attending the next 
Senior Leadership Team's informal meeting to discuss the 
cross office project on this. 


Actions 
Annabelle McGuiness to change the point of contact for post Brexit 
work on the work stream tracker to Emma Bate. 


Sue Markey to liaise with Emma Bate with regard to outsourcing 
contracts. 


6. Technology Update 
Discussion 
Peter Brown presented the Threats and Opportunities to information 
rights arising from technology report. The paper will continue to 
develop and will form part of the Technology Strategy which is 
currently in draft form awaiting the start of the new Head of 
Technology Policy. 


It was suggested that each of the items in the report be given the 
following rating; Watch, Engage or Strategic 


Decision 
The group agreed to amend the title of the report to Benefits and 
Risks. 


Steve Wood confirmed that he will be taking the report to the 
Senior Leadership Team with a proposal to fund a technology 
research fellowship. 


Actions 

Peter Brown to change name of report to Benefit and Risks from 
New and Emerging Technologies and to add the ratings of watch, 
engage and strategic, and to circulate to members by the next 
meeting (7/12/17) 


7. Consultation and Select Committee responses 
Discussion 
Carl Wiper flagged a new consultation on children’s privacy to be 
added to the list. 


8. Court J udgements 
Schrem 2 Judgement 
Discussion 
Emma Bate highlighted the possible key risks to come out of the 
judgement. There are concerns about the continuing use of 
standard contractual clauses and binding corporate rules relating to 
transferring data to the United States. 


Decision 
It was agreed to communicate to stakeholders that we are aware of 
the uncertainties surrounding the judgement. 


Actions 

Robert Parker to consider a blog on the judgement by ? 

Emma Bate to provide bullet points on the judgement for use in 
standard presentation slides. 


Caroline Robinson to ensure the item was a standing item for the 
Steering Group. 


9. Change Programme Policy & Engagement Projects 
Interactions between the Change Programme and Policy 
Directorate: 
Discussion 
Rachel Cragg raised the concern that in recent meetings there has 
not been enough time to dedicate to a thorough review of the RAID 
log and Backlog. 


There were concerns that there was not the same level of 
interaction between the change programme and Policy & 
Engagement area as there is within the Operational Directorate via 
the Service Delivery Project Board. 


The group discussed the possibility of a Policy and Engagement 
Board being set up. 


Decision 

It was agreed that the change programme aspects of policy 
directorate should be given its own project board with a more 
dedicated meeting. 


Actions 
Rachael Cragg to email a proposal on constituting a new group for 
Policy for the change programme by ? 


TPS Renewal: 

Discussion 

Rachael Cragg flagged the TPS renewal on the risk log. We need to 
look at re-procuring the contract. The risk also needs an owner. 


Decision 
It was confirmed that Louise Byers is leading on the TPS renewal. 


Actions 
Rachel Cragg to contact Louise Byers with regard to the TPS 
renewal and the need to take matters forward. 


Outsourcing on Guidance: 

Discussion 

Emma Bate updated the steering group on work done on possibly 
outsourcing development of some guidance. 

SME Toolkit: 

Discussion 

Anulka Clarke advised that the release of the new GDPR SME toolkit 
has been brought forward from the New Year to November. We are 
now providing a checklist for controllers and a new check list for 
processors. 


Personal Data Breach Helpline: 

Discussion 

Rachael Cragg confirmed that the PDB helpline had been launched 
on Monday (6/11/17) and 103 calls had been received over the last 
three days. These calls have been mainly enquiries but there have 
been some personal data breaches which have been dealt with and 
closed where appropriate. 


Funding Regime: 
Discussion 


The group was updated on progress in bringing in the new funding 
system. 


10. Any other business 


Jonathan Bamford confirmed that an international law enforcement 
coordination group has been set up. 


A Surveillance cross office group has also been set up. 
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Operations Steering Group minutes 


10 November 2017 


Members 

James Dipple-Johnstone 
Jo Pedder 

Emma Deen 

Faye Spencer 

Andrew Laing 


Adam Sowerbutts 


Steve Eckersley 
Anulka Clarke 
Robert Parker 
Richard Marbrow 


Secretariat 
Caroline Robinson 


Deputy Commissioner (Operations) 
Head of Policy and Engagement 

Head of Business Development & IT 
Head of Customer Contact 

Head of Data Protection Complaints and 
Reviews 

Head of Freedom of Information Complaints 
and Appeals 

Head of Enforcement 

Head of Assurance 

Head of Corporate Communications 
Corporate Governance Group Manager 


Corporate Governance Officer 


1. Introductions and apologies 
Apologies were received from Robert Parker and Richard Marbrow. 


2. Matters arising from the previous meeting 


Minutes 


The minutes from the previous meeting were agreed. 


Actions and decisions 
Outstanding action points were updated and cleared where possible. 


3. Operations Summary Report 


Discussion 


The proposed changes to the report have been made however 
Anulka Clarke noted that the numbers for Assurance were incorrect. 


Steve Eckersley highlighted that elements of the Enforcement 
figures have been omitted from the report. 


The group discussed possible additions that would be beneficial to 
include in the report. 


Actions 

Operation heads of department to liaise with lain Campbell by 20 
November with regard to the additions that would benefit their 
department. 


4. Operations Department Heads verbal updates 
Assurance: 


Recently completed three SME workshops in London, 
Manchester and Birmingham 

A charities workshop was recently undertaken in Brighton 
The Level B assessment centre was successful and resulted in 
an appointment 

The Level D recruitment has now closed and shortlist was 
ongoing. 

The Level E vacancy for BCR and for a BCR Group Manager 
are being advertised. 

BCRs; 27 are currently out for review, out of a total of 40 
outstanding BCRs. 

The toolkit checklist has been updated and is currently 
awaiting policy review. The toolkit is on track for going live at 
the end of November. 

The BCR blog is nearly completed 


James Dipple-J ohnstone confirmed that there has been interest 
from Audit companies with regard to secondment opportunities. 


Action 

Faye Spencer to ask for further information from Rob Parker with 
regard to the Small Business Day and circulate to the group by 20 
November. 


Data Protection Complaints and Appeals: 


Andy Laing confirmed that performance this month has been 
good. The receipts of 1870 is the highest ever with the 
closures of 2150 also the highest ever. 

Caseloads are now under 3000 cases which is moving in the 
right direction 

Staffing; currently running at 88.3 with a department target 
of 100. Two new starters arriving next week. 

Homeworking kit is currently being tested. There is a 
possibility of increasing the number of people being able to 
work from home with will help alleviate the desk situation. 


e The Level C assessment centre resulted in 23 successful 
candidates. 
e GDPR training is under way within the department 


Enforcement: 

e Yetto see the impact of the Personal Data Breach team 

e Keeping pace with receipts although there was a drop in 
October 

e A number of staff members have been seconded to Operation 
Cederberg 

e Four fines have gone out this week from the Anti-Spam team 

e Currently there are two vacancies within the Criminal 
Investigations Team 

e Crimson database has been delayed slightly 

e Departmental training is underway 

e The ICO is joint lead with the Netherlands on the A29 working 
party taskforce. 


James Dipple-Johnstone confirmed that there has been interest 
from cyber security operatives with regard to secondment 
opportunities within the ICO. 


FOI Complaints and Appeals: 
e October has been the busiest month of the year so far with an 
intake of 528. It has also been the best month for output. 
e Appeals remain static. 
e Three new Level Cs started on Monday. 
e The assessment centre for Level Bs resulted in an 
appointment for a new administrator. 


9. Cyber Security 
Discussion 
The draft cyber security report was discussed. 


The tiger teams were also discussed and how they will be 
resourced. 


Actions 
Any comments on the report to be sent to James Dipple-J ohnstone 
by 24 November. 


6. Risks and Opportunities 
Discussion 
There were no comments on the risk register. 


8. Any other business 
Staffing requirements 2018-19: 


Each operations department head ran through their bids for 
resourcing for 2018-19 


Action 
All resourcing bids to be returned to James Dipple-Johnstone by 
Monday 13 November. 


Investigative Powers commissioner: 
James Dipple-Johnstone updated on the meeting. 


